{
  "llm": {
    "conf": 0.85,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "hostile",
    "interpretation": "Embedded base64 encoded executable"
  },
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": 25,
    "conf": 92,
    "mods": [
      {
        "cls": 1,
        "raw": 0.9990331,
        "rte": "az",
        "prob": 0.9990331
      }
    ],
    "prob": 0.85,
    "files": [
      {
        "id": 0,
        "lvl": 25,
        "conf": 92,
        "prob": 0.8500000238418579,
        "type": "iso"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-02T22:39:04Z"
  },
  "path": "575c7db5be5d8e616f9aac99a1c5eea7dd8454be245aba610be252e08b68068b.iso",
  "raw": {
    "v": "8",
    "rev": "d9759",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "000000000000000000000000000000000000000000000000000000000001lQSQZf-.nQx(kZZarR^HarR^HarR^HarR^HarR^HarR^HarR^}zGf/kA^q1CfFCpyarR^HarR^HarR^HarR^HarR^b000000002O0rr9100g\u003cP00000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ISO-9660 primary volume descriptor marker",
                "i": "metadata/file/format/structured::primary-volume-descriptor",
                "o": 32769,
                "z": 5,
                "cf": 1.0
              }
            ],
            "ln": 32721
          },
          {
            "b": "vqYZ?l1t1Jz/bL^C4CMkl1t1Jz/bLyvrt{Qz*aGSBzkVh07?6IwPzi?BzkVh0b(*-q/#L\u003eA:-E1x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9l}z!%l3v@#B6zu97kBywcSvR/Qyz!%l3v@#B6zu94xzGG]qy^SbSy?m9#x(v\u003e?l$7gCqE%VMBzkVhlVl^SwN/*@z/bLSzercXxK#3?pHX6Iv@$7Ry\u00260V)BzkVh07pmqvn.2/lVl^SwN/*@z/bL!B-7Yhx(v\u003e?zV",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 127816,
                "z": 17,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 127752
          },
          {
            "b": "Bz(9#lT:!vB.\u003eGdwK*=VB-msWz!\u0026{4m@\u0026J\u003cz#-0:gHBH4A=l8t07zcK07?egzBnBAnPB/Gp\u0026VL6xKL]YnP5Y\u0026yH{jKzdm6%08vVNvR6MWq/)4]zF8\u003cUvpS}\u002609B8OqE%oEwPv=Mzerf.CYV?{vpS}\u00260chTVwmY=YnK^SszddJ.A=lbnwmY=Yw]zZbvrts^z*2\u00269wPv=\u0026A=lbnwmY=Yq/)4]zF8pUx(4r\u003eASw\u003cCCt-v6mSJA:luN0UwmY=Yl$7gCqG3+CB.LV5wPv=WB.LV5wPv=tCYm8ewmY=YB7Gl1wPv=qx(mD)ASyb\u003ezddc@wmY=YxjVf(qE%]/B-H#6o\u003c}{FxjV8-lVl*Xz/fc7Bw=W\u003ez/{8gwLDPJvp%d(077yjnP5SYxjV8-nPNEvBy/8@ASy31xK#h:lVl^SwN/*@z/d{QvqYZ?mrSlWBvY?TwnC*$07pmqvn{VAy?kt0z*aMZvqYZ?mrSlWBvY?TwnC*$07pmqvn{VAy?kw1z*aL",
            "n": [
              {
                "c": 3,
                "d": ".NET reflection marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
                "o": 128419,
                "z": 12,
                "cf": 0.9399999976158142
              },
              {
                "c": 3,
                "d": ".NET resource loader marker in opaque content",
                "i": "metadata/file/format/structured::embedded-dotnet-resource-loader",
                "o": 128615,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 128355
          },
          {
            "b": "bpT]/bpT]/xcO(JdKcz/dSol8bpT]/bpT]/bpT]/bpT]/q6NLndKcz/dTaxcdKcACq6NL:mqkdmdKcAsbpT]/bpT]/bpT]/bpT]/bpT]/i5a0oqBhPTmmwBJr3J\u003eqdP68vll^%8dKcz/dKcz/dKcz/dKcAnoe6jhBYy}nB$(GUr5)xBxeAW#xeAX2C%UCkx*Lf$B#sbCxII5?BvHaSzAhMzCs3N+Aa?:xxFrdWlt6+0phRpaBr-m(xlv/ybpT]/bpT]/bpWsJdKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dKcz/dP4AubpT]/bpT]/bpT]/bpT]/xg%K1bpUVafc.}\u003edKcz/dN+NibpT]/bpVzjdKcAuAAl3s000000g-#%00000000000jI?n001bw00000000000000000000000000i2\u0026900000000000001alVm0lCX6PTx(i]/B7ocewO0G8y?%7K00030b(/5M06{PK07c-O07u(S07N2W07^e.080q=08iC*08AO\u003e08S.]08\u0026\u003e%0962109oe509Gq90at\u003ep0aM1t0a=dx0a#pB0bhBF0bzNJ0bRZN0b?\u003cR0c50V0cncZ0cFo+0cXA/0c[M\u003c05ayc05sKg05KWk05:",
            "n": [
              {
                "c": 5,
                "d": "Detects an base64 encoded executable with reversed characters",
                "i": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
                "o": 970375,
                "z": 52,
                "cf": 0.8999999761581421
              },
              {
                "c": 3,
                "d": "Embedded .NET runtime string marker",
                "i": "metadata/file/format/structured::embedded-dotnet-runtime-string",
                "o": 970678,
                "z": 11,
                "cf": 0.9599999785423279
              }
            ],
            "ln": 970247
          }
        ],
        "mol": "MdTh",
        "sha": "575c7db5be5d8e616f9aac99a1c5eea7dd8454be245aba610be252e08b68068b",
        "path": "575c7db5be5d8e616f9aac99a1c5eea7dd8454be245aba610be252e08b68068b.iso",
        "risk": 109,
        "size": 974848,
        "type": "iso",
        "facts": {
          "metrics": {
            "file": {
              "size": 974848.0,
              "entropy": 7.64,
              "size_bytes": 974848.0
            },
            "binary": {
              "overall_entropy": 7.64,
              "peak_region_bytes": 754688.0,
              "peak_region_entropy": 7.85
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format/structured::embedded-dotnet-reflection-marker",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": ".NET reflection marker in opaque content",
            "spans": [
              [
                127816,
                17
              ],
              [
                128419,
                12
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-runtime-string",
            "conf": 0.9599999785423279,
            "crit": 3,
            "desc": "Embedded .NET runtime string marker",
            "spans": [
              [
                970678,
                11
              ]
            ]
          },
          {
            "id": "metadata/file/format/structured::embedded-dotnet-resource-loader",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": ".NET resource loader marker in opaque content",
            "spans": [
              [
                128615,
                15
              ]
            ]
          },
          {
            "id": "third_party/SigBase/SUSP/Reversed/Base64/Encoded/EXE",
            "conf": 0.8999999761581421,
            "crit": 5,
            "desc": "Detects an base64 encoded executable with reversed characters",
            "spans": [
              [
                970375,
                52
              ]
            ]
          }
        ]
      }
    ]
  }
}